alamb opened a new pull request, #11821: URL: https://github.com/apache/arrow-rs/pull/11821
# Which issue does this PR close? - N/A (fixes CI on the `58_maintenance` branch) # Rationale for this change The `Audit` job fails on pushes to `58_maintenance` (for example https://github.com/apache/arrow-rs/actions/runs/39737710459) because an advisory was published against a version pinned in the committed `Cargo.lock`: - RUSTSEC-2026-0384: `tokio` 1.54.0 (race condition in `tokio::time::Interval`), fixed in 1.54.1. The 1.54.0 release has also been yanked. `main` (tokio 1.53.3) and `59_maintenance` (tokio 1.53.1) are not affected. `57_maintenance` pins the same 1.54.0 and gets the same fix in https://github.com/apache/arrow-rs/pull/11819. # What changes are included in this PR? Update only `tokio` in `Cargo.lock` from 1.54.0 to 1.54.1 (version and checksum). Running `cargo update -p tokio --precise 1.54.1` also re-unified the `windows-sys` dependency of five unrelated crates, so this PR applies just the `tokio` entry to keep the diff minimal. Verified locally that `cargo audit --ignore RUSTSEC-2026-0194 --ignore RUSTSEC-2026-0195 --ignore RUSTSEC-2026-0176 --ignore RUSTSEC-2026-0177` (the CI invocation) passes with only the one already-allowed `unmaintained` warning, and that the lockfile resolves with `cargo +1.85.0 metadata --locked`. tokio 1.54.1 has `rust-version = "1.85"`, matching the workspace MSRV. # Are these changes tested? CI # Are there any user-facing changes? No. This only affects the lockfile used for workspace builds and CI. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
